Privacy Policy

1. Scope

Simply Local Hosting (ABN 78 752 965 845), G03 / 33 Racecourse Road, North Melbourne VIC 3051 ("we", "us") is committed to protecting your privacy and handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Information we collect

• Account details: your name, email and a securely hashed password.
• Billing details: processed by our payment provider, Stripe. We do not store your full card number.
• Domain registrant & eligibility details required by registries to register or manage domains.
• Technical data: IP address, browser information and usage logs.
• Cookies: essential cookies to keep you signed in and operate the site.

3. How we use your information

To provide and support your services, authenticate your account, process payments, register and manage domains, communicate with you about your account, meet legal obligations, and improve our services.

4. Disclosure to third parties

We share personal information only as needed to deliver services — including with Stripe (payment processing) and Synergy Wholesale and the relevant domain registries (domain and hosting provisioning), and where required by law. Some providers may process data overseas; where they do, we take reasonable steps to ensure APP-consistent handling. We do not sell your personal information.

5. Data location

We host on Australian infrastructure. Some third-party providers may store limited data outside Australia as described above.

6. Cookies and local storage

Only the cookies this site needs in order to work are set, and we name them rather than describing them in general terms. There is no analytics and no advertising anywhere on this site, and the only script we load from anywhere but our own servers is Stripe’s payment form — which is what takes your card details, and which runs its own fraud checks on the pages that show it. So there is nothing here to opt out of.

• Your sign-in session (better-auth.session_token): what keeps you signed in as you move around your account. Deleting it signs you out.
• Two-factor sign-in (better-auth.two_factor): set for ten minutes between your password and your authenticator code, so the second step knows which sign-in it belongs to. Only if you have two-factor authentication switched on.
• Verification (slh_verify): ties an email or mobile verification code to the browser that asked for it, so a code cannot be used somewhere else. It lasts 24 hours.
• Staff impersonation (better-auth.admin_session, with better-auth.dont_remember beside it): set only when a member of our team is viewing your account to help you, and only for the length of that session. The first holds the staff member’s own session while they do, and the second stops the session they are using from being extended by the work. Both are cleared when they leave, and it is recorded in our audit log.

Those are ours. Your browser sends them back to us with every request, and we do not use them for anything but the job described beside each one. Because this site is served over HTTPS, your browser stores the ones beginning better-auth. with __Secure- in front — __Secure-better-auth.session_token, and so on — which is what you will see if you look at them.

On the pages that show a card form, Stripe’s payment script sets two more under our domain rather than its own: __stripe_mid (about a year) and __stripe_sid (half an hour). They are Stripe’s, not ours, and Stripe uses them to tell a real payment from a fraudulent one. We do not read them, and they are not advertising or analytics cookies. Stripe’s own privacy policy covers them.

Your browser also keeps two things of ours for you in local storage. The fact that you have read the cookie notice at the bottom of this site (slh-cookie-notice) never leaves your device. Your shopping cart (slh_cart_v1) stays on your device while you are filling it — then, when you check out, what is in it is sent to us so we can price it and record your order: the plan, the term, how many, and any domain name you typed on a line. Clearing your site data removes both.

7. Security

We use industry-standard measures including encryption in transit, hashed passwords and optional two-factor authentication. No method is completely secure; please use a strong, unique password and enable 2FA.

8. Data retention

We retain personal information while your account is active. When you close your account we erase the personal information we hold about you — your sign-in and contact details, and the registrant and contact details we hold for any domain or service you had with us.

We cannot erase everything. Australian tax and company law requires us to keep records of the sales we make — invoices and the accounting entries behind them — for several years, and an invoice cannot be altered once it is issued. Those records stay in our books with the name and address they were issued under. They are no longer connected to a usable account, and we do not use them to contact you.

9. Accessing, correcting and deleting your information

You can view and update much of your information in your customer portal at any time.

A copy of your data. Sign in and go to Profile & Security → Your data to download everything we hold about you as a single file, free and straight away. For your own safety it leaves out passwords, two-factor secrets and domain transfer codes — ask us if you need a transfer code. If you can't sign in, contact us and we'll send it to you.

Closing your account. The same page has Close my account. Everything you have with us needs to be finished with first — any hosting cancelled, any domain expired or transferred away — because we can't erase the details a registry holds for a domain we are still managing for you. A member of our team then carries the closure out by hand rather than a script doing it automatically, so you can change your mind up until it happens. We'll email you when it's done, and tell you what we had to keep.

We also delete your customer record, including any saved card, at Stripe, our payment processor. Stripe keeps its own record of payments it processed, as it is required to.

One thing we keep on purpose: a one-way cryptographic hash of the email addresses we erased. Our domain supplier keeps its own copy of the contact details on a domain, and without this the address would simply come back into our systems the next time we read their records. We cannot look up an address from the hash — only check one we are already given — and it is used for nothing except recognising an address we have been asked to forget. It stops applying to records created after someone confirms that address on a new account, and a member of our team can lift it entirely if it ever catches an address that wasn’t yours.

If you would rather ask us than use the portal, contact us — we treat that the same way, at no charge.

10. Complaints

If you have a privacy concern, please contact us first. If you're not satisfied with our response, you may escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

11. Changes

We may update this policy from time to time. Changes take effect when published to this website.